No need to have somebody hand over a server. If the implant happened in two segments of the supply chain as the article claims, it shouldn't be very difficult to find one.